← Back

CVE-2025-59358

nvd nist
Published: Sep 15, 2025Modified: Oct 14, 2025

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: reefs@jfrog.com (Secondary)

Description

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

Affected (1)

Chaos Mesh
1 product
Chaos Mesh
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Chaos Mesh
Before 2.7.3

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: reefs@jfrog.com
Issue TrackingPatch
Source: reefs@jfrog.com
ExploitThird Party Advisory

Timeline

No history available yet.